WordPress Events Manager Capability Mapping Bypass

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18366 is a critical privilege escalation vulnerability in the Events Manager WordPress plugin that exploits improper capability mapping to bypass WordPress access controls. The plugin fails to properly scope its capability checks, allowing unauthenticated attackers to perform privileged actions—including password changes, administrator account creation, and user deletion—against any WordPress account whose user ID corresponds to an Events Manager post ID. This affects all installations running the plugin before version 7.4.1, with particular risk to sites managing events or calendars where post IDs are predictable or enumerable.

Casky's 224 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across TA0004 (Privilege Escalation) techniques. Practitioners using Casky would see detection patterns aligned with CWE-269 (Improper Access Control) identifying unauthorized capability invocation, API parameter tampering that bypasses scope validation, and suspicious account modification requests originating from unauthenticated sessions. The platform's MITRE ATT&CK mapping would highlight indicators such as account manipulation without corresponding authentication logs, privilege escalation via plugin-specific endpoints, and post ID enumeration attempts that precede account takeover actions—enabling security teams to distinguish legitimate WordPress admin functions from exploitation attempts targeting this specific capability mapping flaw.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18366.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-18366

Casky has 224 skills that investigate the attack patterns behind CVE-2026-18366. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn